Send an email to security@pedalcms.com. Use responsible disclosure policy and do not report errors publicly for 30 days to give us time to resolve without affecting users.